The forever agent for everyone
Somewhere for an AI agent to run: bounded by what you granted it, able to account for what it did, and living on your machine.
What it is
Every agent needs somewhere to run.
Modern AI agents do more than answer questions. They run commands, edit files, call other services, and make changes that outlast the conversation. To do any of that an agent needs somewhere to run — a layer that decides what it is allowed to touch, holds what it has learned, and keeps a record of what it did. That layer is called a harness. Ennius is ours.
Most harnesses are built around what an agent can do. Ennius is built around what it should be allowed to do, and what it can account for afterwards.
The problem
Agents are being handed real authority on an architecture designed for chat.
Your shell. Your files. Your calendar and your inbox. The reach keeps growing, and two things break first. A delegated agent inherits whatever the one above it could already do — so authority spreads sideways with nothing to stop it. And its memory is a pile of notes nobody can vouch for, where something the model guessed last month is indistinguishable from something you actually said.
Those two failures compound. An agent that can quietly write unfounded claims into shared memory degrades every session that comes after it. Ennius is built the other way round: authority is granted explicitly and narrows as it travels, and a memory is a record with an origin rather than a paragraph that reads well.
The approach
Four commitments, built in rather than bolted on.
-
Bounded by construction
Every agent runs inside an explicit grant of what it may touch. When work is delegated, that authority narrows — it never widens on its own. At the edge of what it holds, an agent asks rather than improvises.
-
Memory with a provenance
Not a pile of notes. Every record carries where it came from, how sure it is, and what it replaced — so a claim you made and a claim the model inferred are never the same thing. You can ask why it believes something.
-
Built for teams
What one person's agent learns, the whole team can rely on. A shared record carries its author as well as its origin, contradictions between two people get arbitrated rather than silently overwritten, and the append-only ledger is already the audit trail.
-
Yours to keep
Everything it remembers lives in a file you own — readable, portable, and straightforward to take elsewhere. The way out is as wide as the way in, because loyalty should be earned rather than engineered.
Why we build it
Trustworthy AI should not be a privilege.
-
The same guarantees for everyone
An agent you can hold to account should not be something you have to be a large company to get. One person on a laptop and a thousand people across a business get the same bounds, the same record, and the same ability to ask what happened. A guarantee only some people are given is a marketing claim rather than a guarantee.
-
Your data is yours
What an agent learns about you belongs to you. It stays on your machine, in a file you can open and read, private from the moment it is written. Nobody should have to rent their own history back, and nobody should have to take it on faith that a copy held somewhere else is being looked after.
-
Permission is given, never assumed
Security here is not a wall around the agent. It is an agent that can answer two questions at any moment — what am I allowed to touch, and what have I touched — not as a report compiled afterwards, but as the thing governing it while it works. Software that can act on your behalf without answering those is not powerful. It is unaccountable.
Every one of these costs something to build and would be easier to skip. We are building them anyway, because an agent you cannot check is not one you should be running.
In development
If you are facing these challenges now, we would like to hear about it.
Ennius is being built now. There is nothing to download yet — but if you are thinking about what it takes to let an agent work unattended, that is exactly the conversation we want.